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Summary 

Questions about the scope and efficacy of the background checks required during certain firearm 
purchases have gained prominence following recent mass shootings. These background checks 
are intended to identify whether potential purchasers are prohibited from purchasing or 
possessing firearms due to one or more “prohibiting factors,” such as a prior felony conviction or 
a prior involuntary commitment for mental health reasons. Operationally, such background 
checks primarily use information contained within the National Instant Criminal Background 
Check System (NICS) and a particular focus of the debate in Congress has been whether federal 
privacy standards promulgated under the Health Insurance Portability and Accountability Act 
(i.e., the HIPAA privacy rule) or state privacy laws are an obstacle to the submission of mental 
health records to NICS. 

Under the Gun Control Act of 1968 (GCA), as amended, persons adjudicated to be mentally 
defective or who have been committed to a mental institution are prohibited from possessing, 
shipping, transporting, and receiving firearms and ammunition. Neither a diagnosis of a mental 
illness nor treatment for a mental illness is sufficient to qualify a person as “adjudicated as a 
mental defective.” Rather, an individual’s “adjudication as a mental defective” relies upon a 
determination or decision by a court, board, commission, or other lawful authority. The definition 
of “committed to a mental institution” may apply only to inpatient settings. At least one federal 
court has held that the Supreme Court’s recent recognition of an individual right to possess a 
firearm suggests that some emergency hospitalization or commitment procedures, that may not 
have as many procedural safeguards as formal commitment, should not be included within the 
meaning of “involuntary commitment” for purposes of the GCA. In 2007, Congress passed the 
NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make 
additional grants to states to improve electronic access to records as well as to incentivize states 
to turn over records of persons who would be prohibited from possessing or receiving firearms. 

In 2012, the Government Accountability Office (GAO) reported that a variety of technological, 
coordination, and legal (i.e., privacy) challenges limit the states’ ability to report mental health 
records to NICS. The HIPAA privacy rule, which applies to most health care providers, regulates 
the use or disclosure of protected health information. On February 14, 2013, HHS announced that 
it will seek to amend the HIPAA privacy rule to remove any potential impediments to state 
reporting of mental health records to NICS. The privacy rule is most relevant as a potential 
obstacle where information used to generate mental health records on individuals prohibited from 
gun possession under the GCA is held by health care providers in states that do not expressly 
require disclosure of such records to NICS. Courts and health care providers that generate such 
prohibiting mental health records may also be subject to state health privacy laws that may be 
more restrictive than the HIPAA privacy rule. 
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Q uestions about the scope and efficacy of the background checks required during certain 
firearm purchases have gained prominence following recent mass shootings. 1 These 
background checks are intended to identify whether potential purchasers are prohibited 
from purchasing or possessing firearms due to one or more “prohibiting factors,” such as a prior 
felony conviction or a prior involuntary commitment for mental health reasons. If disqualifying 
information surfaces during the background check, the transfer is not completed. Operationally, 
such background checks primarily use information contained within the National Instant Criminal 
Background Check System (NICS), maintained by the Federal Bureau of Investigation (FBI), and 
a particular focus of the debate in Congress has been whether the FI1PAA privacy rule or state 
privacy laws are an obstacle to the population of NICS with prohibiting mental health records. 

This report provides an overview of prohibiting mental health records under current federal law, 
and distinguishes those records from other types of mental health information that would not 
disqualify an individual from purchasing a firearm. This report also provides an overview of 
NICS and discusses potential issues arising from state and federal medical privacy laws that may 
impede states’ efforts to submit prohibiting mental health records to NICS. 2 



Prohibiting Mental Health Factors Under the Gun 
Control Act of 1968 

Under the Gun Control Act of 1968 (GCA) 3 , as amended, certain categories of persons are 
prohibited from possessing, shipping, transporting, and receiving firearms and ammunition. 4 
These nine categories of persons who are prohibited include: 

1 . Persons convicted of a crime punishable by a term of imprisonment exceeding 
one year; 

2. Fugitives from justice; 

3. Individuals who are unlawful users or addicts of any controlled substance; 

4. Persons adjudicated to be mentally defective, or who have been committed to a 
mental institution; 

5. Aliens illegally or unlawfully in the United States, as well as those who have 
been admitted pursuant to a nonimmigrant visa; 

6. Individuals who have been discharged dishonorably from the Armed Forces; 

7. Persons who have renounced United States citizenship; 

8. Individuals subject to a pertinent court order; and 

9. Persons who have been convicted of a misdemeanor domestic violence offense. 5 



1 See CRS Report R43004, Public Mass Shootings in the United States : Selected Implications for Federal Public 
Health and Safety Policy, coordinated by Jerome P. Bjelopera. 

2 This report is limited to a discussion of currently applicable law, and does not discuss proposals to revise the types of 
mental health records that would disqualify an individual from purchasing or possessing a firearm. 

3 P.L. 90-618(1968). 

4 18 U.S.C. §922(g). Individuals who are under indictment for a felony are also prohibited from receiving or 
transporting firearms or ammunition. 18 U.S.C. §922(n). 



Congressional Research Service 



1 




Submission of Mental Health Records to NICS and the HIPAA Privacy Rule 



Of these categories, only the fourth is primarily concerned with mental health issues . 6 The 
sections below provide a more detailed discussion of the scope of this category’s two sub- 
components: adjudication as a mental defective and commitment to a mental institution. 



Adjudication as a Mental Defective 

As noted above, the GCA prohibits individuals “adjudicated as a mental defective” from 
possessing, receiving, transferring, or transporting a firearm. The term has been further defined 
by federal regulation as: 

(a) A determination by a court, board, commission, or other lawful authority that a person, as 
a result of marked subnormal intelligence, or mental illness, incompetency, condition, or 
disease: 

(1) Is a danger to himself or to others; or 

(2) Lacks the capacity to manage his own affairs. 

(b) The term shall include — (1) a finding of insanity by a court in a criminal case, and (2) 
those persons found incompetent to stand trial or found not guilty by lack of mental 
responsibility [under the Uniform Code of Military Justice]. 7 

It is important to note that despite references to “mental illness” in the definition, neither a 
diagnosis of a mental illness nor treatment for a mental illness appears, by itself, to qualify a 
person as “adjudicated as a mental defective .” 8 Thus, while a health care provider may provide to 
a third party (i.e., a court, board, commission, or other lawful authority) an assessment of an 
individual’s mental health for purposes of adjudication, the provision of mental health treatment 
alone is not considered a determination for puiposes of being considered “adjudicated as a mental 
defective,” nor is treatment necessary for the determination. Rather, an individual’s “adjudication 
as a mental defective” relies upon a determination or decision by “a court, board, commission, or 
other lawful authority.” 

Physicians and other health care providers generally do not fall within this list of authorized 
decision-makers, with the exception of certain instances under state law where a health care 
provider may be authorized by statute to admit a patient to involuntary psychiatric treatment. A 



(...continued) 

5 18U.S.C, §922(g). 

6 In the 1 13 th Congress, Senator Lindsey Graham introduced S. 480, the NICS Reporting Improvement Act of 2013, 
that would revise 18 U.S.C. 922(g)(4) to replace references to “mental defective” with “mentally incompetent” and 
“mental institution” with “psychiatric hospital.” The bill would also expressly define the type of hearings that qualify 
for purposes of being “adjudicated mentally incompetent or ... committed to a psychiatric hospital.” A full discussion of 
the effects of these amendments is beyond the scope of this report. 

7 27 C.F.R. §478.1 1. It is likely that any record that fits the definition under (b) would be related to criminal record 
histories that are more easily accessible by the states. However, it has been reported that a majority of states have low 
submission rates for the types of records that fall under subsection (a). MAIG Report. 

8 See, e.g., U.S. v. Vertz, 102 F. Supp.2d 787, 788 (W.D. Mich. 2000), aff’d on other grounds , 40 Fed. Appx. 69 (6 th 
Cir. 2002) (“Despite the extensive evidence of medical illness, for purposes of criminal liability under the federal 
firearms statute, it is not sufficient that the defendant has been diagnosed as mentally ill by his treating physicians. The 
statute specifically requires that the individual have been adjudicated as a mental defective or committed to a mental 
institution.”). 
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health care provider, under these circumstances, could potentially be considered an “other lawful 
authority,” who makes a determination which falls within the federal statute criminalizing 
firearms possession by an individual who is “adjudicated as a mental defective” or “committed to 
a mental institution.” See discussion below at “Emergency Admission or Hospitalization.” 

Whether the definition of “adjudicated as a mental defective” includes individuals who have been 
assigned fiduciaries to manage monetary benefits received from a federal agency is subject to 
interpretation, as illustrated by the different policies of the Department of Veterans Affairs (VA) 
and the Social Security Administration (SSA). In particular, the definition includes those who are 
determined “as a result of . . . condition . . .[to] lack[] the capacity to manage his own affairs.” 
Accordingly, VA policy requires that an individual who receives VA monetary benefits and who 
“lacks the mental capacity to manage his or her own financial affairs regarding disbursement of 
funds without limitation, and is either rated incompetent by VA or adjudged to be under legal 
disability by a court of competent jurisdiction” be assigned a fiduciary (who manages the money 
disbursed by VA) and be reported to NICS . 9 SSA does not appear to have a comparable policy for 
representative payees (i.e., individuals who have been assigned a fiduciary to manage their SSA 
monetary benefits). In a letter to the Vice President, the National Council on Disability (NCD) 
urges him to 

avoid any proposal to link the Social Security Administration’s database of representative 
payees with the FBI’s National Instant Criminal Background Check System (NICS). 
Whatever merits such a proposal might seem to present, such benefits are outweighed by the 
inaccurate and discriminatory inference that would result: equating the need for assistance in 
managing one’s finances with a presumption of incapacity in other areas of life.... NCD 
recommends you ensure that the selection of a representative payee continues to have no 
implication on other areas of rights beyond financial decision-making . 10 



Commitment to a Mental Institution 

The term “committed to a mental institution” is defined through regulation as 

A formal commitment of a person to a mental institution by a court, board, commission, or 
other lawful authority. The term includes a commitment to a mental institution involuntarily. 
The term includes commitment for mental defectiveness or mental illness. It also includes 
commitments for other reasons, such as for drug use. The term does not include a person in a 
mental institution for observation or a voluntary admission to a mental institution . 1 1 



9 Department of Veterans Affairs, “Privacy Act of 1974; System of Records,” 76 Fed. Reg. 14119, 14122 (Mar. 
15, 2011). Pursuant to NIAA, the VA provides notice to veterans who may fall under the firearms disqualification, and 
the agency has established an administrative procedure that provides veterans with the ability to request relief from 
their firearms disability. See MR21-1MR VA Manual, Part III, Subpart v, Chapter 9 Section B, available at, 
http://www.benefits.va.gov/WARMS/M21_lMRl .asp; Department of Veterans Affairs, Fast Letter to Regional 
Offices Re: Processing Requests for Relief from the Reporting Requirements of the National Instant Criminal 
Background Check System (NICS), available at https://docs.google.eom/document/d/ 

1 lETxpq4dJiiJYcSD8KYXtVTI0hKSqg5hAilxjNQ430Y/edit?pli=l. 

10 Letter from Jonathan M. Young, Chairman, National Council on Disability, to Joseph Robinette Biden, Jr., Vice 
President, United States of America, January 1 1, 2013, http://www.ncd.gov/publications/2013/Janl42013. Legislation 
to prevent these types of VA records from being transferred to NICS has been introduced in the 1 13 th Congress. See, 
e.g., H.R. 577 and S. 572, Veterans Second Amendment Protection Act (1 13 th Cong., 1 st sess.). In other words, these 
bills would allow veterans who have been appointed a fiduciary to keep their firearms. 

11 27C.F.R. §478.11. 
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The use of the term “institution” suggests that the definition of “committed to a mental 
institution” may apply only to inpatient settings. The question of whether the definition applies to 
outpatient commitment was raised following the Virginia Tech shooting in 2007 (see textbox). In 
either case, the definition explicitly excludes “voluntary admission,” and so would not apply to 
individuals voluntarily seeking treatment for mental illness in any setting. 12 



Emergency Admission or 
Hospitalization 

As noted above, state law may authorize a 
health care provider to admit a patient to 
involuntary psychiatric treatment, particularly 
in emergency situations for a brief duration. In 
these limited instances, it is possible that a 
health care provider would be considered an 
“other lawful authority,” and the patient 
receiving involuntary psychiatric treatment 
would fall within the definition of “committed 
to a mental institution” for purposes of the 
GCA. For example, in United States v. Waters, 
the U.S. Court of Appeals for the Second 
Circuit held that the involuntary 
hospitalization of an alleged mentally ill 
individual pursuant to New York state law 14 
met the definition of an “involuntary 
commitment” for purposes of the GCA, even 
though the hospitalization was ordered by the 
director of a hospital upon the certification of 
two physicians. 15 

However, at least one federal court has held 
that the Supreme Court’s recent recognition of 



Example: VirginiaTech Shooting of April 
16,2007 

On April 1 6, 2007, a student at Virginia Tech, Seung Hui 
Cho, shot and killed 32 students and faculty and 
wounded 17 more before killing himself. More than a 
year prior to the shootings, a series of events led to a 
commitment hearing for involuntary admission on 
December 14, 2005. At the hearing the special justice 
ruled that Cho “presents an imminent danger to himself 
as a result of mental illness” and ordered outpatient 
treatment. Following the shooting, a review determined 
that Cho had been ineligible to purchase a gun under 
federal law because he “had been judged to be a danger 
to himself and ordered to outpatient treatment.” The 
review further determined that “Virginia law did not 
clearly require that persons such as Cho — who had been 
ordered into out-patient treatment but not committed 
to an institution — be reported to the [NICS] database.” 
On April 30, 2007, the Governor of Virginia issued 
Executive Order 50, requiring that any involuntary 
treatment order, whether inpatient or outpatient, be 
reported to the NICS. In 2008, the state legislature 
codified this requirement. 13 

Sources: Virginia Tech Review Panel, Moss Shootings at 
Virginia Tech: April 16, 2007, August 2007, 
http://www.governor.virginia.gov/tempcontent/ 
techPanelReport-docs/FullReport.pdf and Virginia 
Executive Order No. 50, (April 30, 2007), 
http://www.lva.virginia.gov/public/EO/ 
eo50%282007%29.pdf. 



12 The Judge David L. Bazelon Center for Mental Health Law, an advocacy organization that opposes involuntary 
outpatient commitment, has compiled a summary of state statutes allowing involuntary outpatient commitments; the 
summary includes a comparison with inpatient commitment statutes. See http://www.bazelon.org/LinkClick.aspx? 
fileticket=CBmFgyA4i-w%3D&tabid=324. For more about involuntary commitment, see National Conference of State 
Legislatures, Screening and Entry into Mental Health Treatment: Balancing Help for the Individual and the 
Community, http://www.ncsl.org/issues-research/health/screening-and-entry-into-mental-health-treatment.aspx or 
National Conference of State Legislatures, Mental Health: What are the issues surrounding involuntary treatment ? , 
http://www.ncsl.Org/issues-research/health/mental-health-faq.aspx#issues. 

13 Va. Code Ann. §37.2-819. 

14 N.Y. Mental Hyg. Law §9.27. 

15 U.S. v. Waters, 23 F.3d 29 (2d Cir. 1994). See also U.S. v. Vertz, 102 F. Supp. 2d at 787 (“prior hospitalization, 
which was supported by a second psychiatrist’s certification, qualified as a commitment to a mental institution”). But 
see U.S. v. Giardina, 861 F.2d 1334 (5 th Cir. 1988) (temporary, emergency detentions for treatment of mental disorders 
or difficulties, which did not lead to formal commitments under state law, did not constitute the commitment 
envisioned by the GCA). 
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an individual right to possess a firearm in District of Columbia v. Heller , 16 suggests that some 
emergency hospitalization or commitment procedures should not be included within the meaning 
of “involuntary commitment” for purposes of the GCA. In United States v. Rehlander, the U.S. 
Court of Appeals for the First Circuit (First Circuit) considered a Maine law which provides 
authority for the brief, but involuntary, detention of individuals in mental institutions on the basis 
of a medical provider’s examination and certification that the individual is mentally ill and poses 
a likelihood of serious harm. 17 In pr e-Heller cases, the First Circuit had held that this emergency 
hospitalization under Maine law qualified as “involuntary commitment” under the GCA. 1S 
Flowever, because the procedures under state law were ex parte 19 and did not have additional 
procedural safeguards, the court held that construing the emergency hospitalization procedures to 
qualify as “involuntary commitment” under the GCA post-Heller would risk depriving 
individuals of their right to bear arms without sufficient due process. Therefore, the appellate 
court overturned its earlier decisions and held that such emergency hospitalizations were not 
“involuntary commitments.” 



The National Instant Criminal Background Check 
System (NICS) 

Under the Brady Handgun Violence Prevention Act of 1993 (Brady Act), the Attorney General 
was required to establish a computerized system to facilitate background checks on individuals 
seeking to acquire firearms from federally licensed firearms dealers. 20 The National Instant 
Criminal Background Check System (NICS) was activated in 1998 and is administered by the 
Federal Bureau of Investigation (FBI). Through NICS, federal firearms licensees submit 
background checks on prospective transferees to the FBI, which queries other databases - 
including the National Crime Information Center (NC1C), the Interstate Identification Index (111), 
and the NICS index - to determine if the transferees are disqualified from receiving firearms. 21 
According to the FBI, records in the NICS Index are voluntarily provided by local, state, tribal, 
and federal agencies, and it “contains [disqualifying records] that may not be available in the 
NC1C or the 111 of persons prohibited from receiving firearms under federal or state law.” 22 

The Brady Act authorized the Attorney General to “secure directly from any [federal] department 
or agency of the United States” information on persons for whom receipt of a firearm would 



16 554 U.S. 570 (2008). 

17 U.S. v. Rehlander, 666 F.3d 45 (1 st Cir. 2012). 

18 U.S. v. Chamberlain, 159F.3d656 (1 st Cir. 1998) and U.S. v. Holt, 464F.3d 101 (1 st Cir. 2006). 

19 The term ex parte refers to a legal proceeding brought by one person in the absence of and without representation or 
notification of other parties. 

20 P.L. 103-159, §103 (1994) [hereinafter Brady Act], 

21 The NCIC is a database of documented criminal justice infonnation that is made available to law enforcement and 
authorized agencies, with the goal of assisting law enforcement in apprehending fugitives, finding missing persons, 
locating stolen property, and further protecting law enforcement personnel and the public. The III, or “Triple I,” is a 
computerized criminal history index pointer system that the FBI maintains so that records on persons arrested and 
convicted of felonies and serious misdemeanors at either the federal or state level can be shared nationally. See Federal 
Bureau of Investigation, National Instant Criminal Background Check System 2011 Operations Report, available at 
http://www.fbi.gov/about-us/cjis/nics/reports/201 l-operations-report/operations-report-2011. 

22 See Federal Bureau of Investigation, Criminal Justice Information Services, National Instant Criminal Background 
Check System Index Brochure, available at http://www.fbi.gov/about-us/cjis/nics/general-information/nics-index. 
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violate federal or state law. The act does not mandate that federal agencies disclose these records, 
rather it mandates that “upon request of the Attorney General, the head of such department or 
agency shall furnish such information to the system.” 23 With respect to states, which are not 
required to submit records to NICS, the Brady Act provided grants to “improv[e] State record 
systems and the sharing ... of the records ... required by the Attorney General under [the Brady 
Act].” 24 However, it did not mandate that states turn over any specific records, even upon request. 



NICS Improvement Amendments Act of 2007 

In 2007, Congress passed the NICS Improvement Amendments Act (NLAA), which authorizes 
the Attorney General to make additional grants to states to improve electronic access to records as 
well as to incentivize states to turn over records of persons who would be prohibited from 
possessing or receiving firearms under 18 U.S.C. §922(g) or (n), with an emphasis on providing 
accurate records relating to those who are prohibited under (g)(4) (“adjudicated as a mental 
defective ”) or (g)(9) (“convicted in any court of a misdemeanor crime of domestic violence ”). 25 
Moreover, it mandates that the Department of Homeland Security make available to the Attorney 
General any records that are related to being a prohibited possessor under federal law. 26 

For federal agencies, NLAA clarifies the standard for adjudication and commitments related to 
mental health. It provides that no department may provide any such record if the record has been 
set aside or the individual has been released from treatment; the person has been found by the 
court or board to no longer suffer from the condition that was the basis of the adjudication or 
commitment; or the adjudication or commitment is based solely on a medical finding of 
disability, without opportunity to be heard by a court or board. 27 It also requires agencies that do 
make such determinations to establish a program that permits a person to apply for relief from the 
disabilities imposed under § 922(g)(4). 28 

With respect to states, N1AA allows a state to be eligible for a two year waiver of the matching 
requirement in the National Criminal History Improvements Grant program, established under the 
Brady Act, if the state provides at least 90% of the records relevant to determining whether a 
person is disqualified from possessing a firearm under federal or applicable state law. 29 To be 
eligible for such a waiver, other requirements include providing updates to NICS regarding any 
record that should be modified or removed from the system, and more detailed information 
regarding those who are convicted of a misdemeanor crime of domestic violence or adjudicated 
as a mental defective under federal law. N1AA also provides the Attorney General discretion to 
award additional grants for purposes of assisting states with upgrading information identification 
technologies for firearms disability determinations as long as they have implemented a relief from 



23 Brady Act, § 103(e). 

“ 4 Brady Act, §106. This program is known as the National Criminal History Improvement Program (NCHIP). This 
program is administered by the Department of Justice Bureau of Justice Statistics (BJS). See http://bjs.gov/index.cfm? 
ty=tp&tid=47. 

25 P.L. 110-180, §§102-104, 301 (2007) [hereinafter NI A A], 

26 NIAA, §10 1(b). 

27 NIAA, §101 (c)(l ). 

28 NIAA, §101(c)(2). 

29 NIAA, §102. 
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disabilities program that meets certain requirements. 30 This grant program is known as the NICS 
Act Record Improvement Program (NARIP). 31 If a state has received a waiver or an additional 
grant under NLAA, the act imposes penalties for non-compliance. 32 The act mandates reductions 
in Department of Justice Byrne Justice Assistance Grant funds and permits the Attorney General 
to make discretionary reduction of these funds if a state does not comply with eligibility 
requirements of NLAA. 3 ’’ 



State Reporting of Prohibiting Mental Health Records to NICS 

In 2012, five years after the NLAA was enacted, the Government Accountability Office (GAO) 
released a report that examined states’ progress in reporting mental health records to the NICS 
databases. 34 It is important to keep in mind that the “mental health records” reported to NICS 
include only individual identifiers and no actual medical information. However, as discussed in 
more detail below, the preparation and submission of such records by health departments and 
health care facilities involves the use of patient information and thus is subject to federal and, in 
many instances, state health privacy laws. 

GAO found that the total number of mental health records that states made available to NICS 
databases increased approximately nine-fold from about 126,000 to 1.2 million between 2004 and 
2011. However, this increase largely reflected the efforts of 12 states. According to GAO, almost 
half of all states increased the number of mental health records they reported by fewer than 100 
over the same time period. 

Both DOJ and state officials told GAO that a variety of technological, coordination, and legal 
(i.e., privacy) challenges limit the states’ ability to report mental health records. Technological 
challenges include updating aging computer systems and integrating existing record systems. 
Several states reported using their NARIP grant funding to automate the collection and 
transmission of records. DOJ officials further emphasized that the technological challenges 

are particularly salient for mental health records because these records originate from 
numerous sources within the state — such as courts, private hospitals, and state offices of 
mental health — and are not typically captured by any single state agency. For example, 
records that involve involuntary commitments to a mental institution typically originate in 
entities located throughout a state and outside the scope of law enforcement, and therefore a 
state may lack processes to automatically make these records available to the FBI . 35 

The fact that mental health records often originate in hospitals and health departments, which are 
typically not connected to law enforcement agencies that make the majority of records available 
to NICS, presents challenges in getting all the relevant entities to collaborate. As an example, 



30 NIAA, §§103, 105. 

31 This program is also administered by the Department of Justice’s BJS. See http://bjs.gov/index.cfm?ty=tp&tid=49. 
32 NIAA, §104. 

33 For more information on the Byme Justice Assistance Grant program, see CRS Report RS22416, Edward Byrne 
Memorial Justice Assistance Grant (JAG) Program , by Nathan James. 

34 U.S. Government Accountability Office, Gun Control: Sharing Promising Practices and Assessing Incentives Could 
Better Position Justice to Assist States in Providing Records for Background Checks, GAO-12-684, July 16, 2012, 
http://www.gao.gov/assets/600/592452.pdf. 

35 Id. at 11-12. 
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GAO cited an April 2012 report by the state of Illinois, Office of the Auditor General, which 
found that for 2010, approximately 1 14,000 mental health records were maintained in nursing 
homes, private hospitals, state mental health facilities, and circuit courts. However, only about 
5,000 records were reported to NICS because of a lack of coordination and other challenges. 
Citing privacy concerns, officials in three of the six states reviewed by GAO reported that the 
absence of explicit statutory authority to share mental health records was an impediment to NICS 
reporting. 36 

In a November 2011 report on NICS reporting, Mayors Against Illegal Guns (MAIG) drew 
conclusions that are broadly similar to those of GAO. 37 MA1G interviewed officials in all 50 
states and the District of Columbia and found that state reporting of mental health records to 
NICS is impeded by a complex set of obstacles including technological and logistical problems, 
privacy concerns, insufficient funding, and a lack of leadership. The MA1G report noted that even 
among states with strong reporting programs, there is considerable variation in the number and 
type of mental health records submitted to NICS. It found that states that have significantly 
improved their reporting in the past few years share a number of common attributes including the 
ability to commit funding to their efforts and effective political leadership. MA1G also found a 
strong association between reporting levels and enactment of state laws that require or authorize 
agencies to report their records. According to MAIG, nine of the 10 states that had the greatest 
increase in records submitted to NICS between September 2010 and October 2011 have laws or 
policies requiring or permitting sharing mental health records with NICS. 



Impact of the HIPAA Privacy Rule on NICS Reporting 

Officials in approximately half of the states told MAIG that state health privacy laws as well as 
the privacy rule promulgated by the Department of Health and Human Services (HHS) under the 
Health Insurance Portability and Accountability Act (HIPAA) were potential obstacles to NICS 
reporting. In some states, officials cited privacy concerns as the primary impediment to reporting. 



HIPAA Privacy Rule Overview 

The HIPAA privacy rule established a set of federal standards to help safeguard the privacy of 
personal health information. 38 Those standards include certain individual privacy rights, such as 
the right of access to one’s health information and the right to request corrections, as well as 
limitations on the use or disclosure of personal health information. The rule applies to (1) health 
plans; 39 (2) health care clearinghouses; 40 and (3) health care providers who transmit health 



36 Id. at 12. 

37 Mayors Against Illegal Guns, Fatal Gaps: How Missing Records in the Federal Background Check System Put Guns 
in the Hand of Killers, November 2011, http://www.mayorsagainstillegalguns.org/downloads/pdf/ 
maig_mimeo_revb.pdf. MAIG is a coalition of mayors from more than 900 cities and towns across the United States, 
co-chaired by New York City’s Mayor Michael Bloomberg and Boston’s Mayor Thomas Marino. The coalition shares 
best practices, develops policies, and supports legislation at all levels of government to reduce the distribution of, and 
access to, illegal and military-style firearms in U.S. cities and towns. 

3S The HIPAA privacy rule, and accompanying general administrative and enforcement requirements, are codified at 45 
C.F.R. Part 160 and Part 164, Subparts A and E. 

39 Health plans include any individual or group plan that provides or pays for medical care. The term encompasses both 
private and government plans. Health maintenance organizations (HMOs) and high-risk pools are specifically covered. 
Most employee health benefit plans are covered. See 45 C.F.R. §160.103. 
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information electronically in connection with one of the HIPAA-covered financial or 
administrative transactions. 41 These persons and organizations are collectively referred to as 
covered entities. 

The privacy rule covers protected health information (PHI) in any form that is created or received 
by a covered entity. PHI is defined as individually identifiable information that relates to the past, 
present, or future physical or mental health of an individual; the provision of health care to an 
individual; or the past, present, or future payment for the provision of health care to an 
individual. 42 

In the broadest sense, the privacy rule prohibits a covered entity from using or disclosing PHI 
except as expressly permitted or required by the rule. 43 As briefly outlined below, the rule 
describes a range of circumstances under which it is permissible to use or disclose PHI. In all 
such instances covered entities can choose whether to use or disclose PHI based on their 
professional ethics and best judgment. The rule specifies only two circumstances when a covered 
entity is required to disclose PHI. A covered entity must disclose PHI to: (1) the individual who is 
the subject of the information, (i.e., patient right of access), and (2) HHS officials investigating 
potential violations of the rule. 44 

Generally, covered entities may use or disclose PHI for the purposes of treatment, payment, and 
other routine health care operations with few restrictions. 45 Under other specific circumstances 
(e.g., disclosures to family members and friends), the rule requires covered entities to give the 
individual the opportunity to object to the disclosure (i.e., opt out). 46 Importantly, the rule also 
permits the use or disclosure of PHI for several specified “national priority purposes” that are not 
directly connected to the treatment of the individual. 47 These uses and disclosures are permitted 
by the rule in recognition of the important uses made of health information outside of the health 
care context. They include the following uses and disclosures: 



(...continued) 

411 Health care clearinghouse is a tenn of art under the privacy rule. It refers to an entity (e.g., claims processor) that 
translates health information received from other entities either to or from the standard fonnat that is required for 
electronic transactions. See 45 C.F.R. §160.103. 

41 Health care providers include any person (e.g., physician, nurse, pharmacist) or entity (e.g., hospital, clinic) that 
furnishes, bills, or is paid for health care in the nonnal course of business. To be a covered entity, a provider must 
conduct one or more of the HIP AA-specified transactions, such as verifying insurance coverage or filing a health claim, 
by transmitting health information electronically in a standard format (i.e., the provider must include certain 
information and use specified codes for diagnosis and treatment) required by HIPAA. Providers that rely on third-party 
billing services to conduct such electronic transactions on their behalf are also covered under the privacy rule. 

Providers that operate solely on a paper basis and do not submit insurance claims electronically are not subject to the 
rule. See 45 C.F.R. §160.103. 



42 


45 


C.F.R. 


§160.103. 


43 


45 


C.F.R. 


§ 164.502(a) 


44 


Id. 






45 


45 


C.F.R. 


§164.506. 


46 


45 


C.F.R. 


§164.510. 


47 


45 


C.F.R. 


§164.512. 



Congressional Research Service 



9 




Submission of Mental Health Records to NICS and the HIPAA Privacy Rule 



• Required by law. Covered entities may use or disclose PHI to the extent that 
such use or disclosure is required by (federal or state) law and the disclosure 
complies with and is limited to the relevant requirements of such law . 48 

• Law enforcement purposes. Covered entities may disclose PHI to law 
enforcement officials for certain specified law enforcement purposes . 49 

• Averting a serious threat to health or safety. Consistent with applicable law 
and standards of ethical conduct, a health care provider may use or disclose PHI 
if the provider in good faith believes the use or disclosure is necessary to 
prevent or lessen a serious and imminent threat to the health or safety of a 
person or the public . 50 

• Specialized government functions. Covered entities may use or disclose PHI 
for several specified essential government functions . 51 

For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, covered 
entities must obtain a patient’s written authorization. 

As discussed above, prohibiting mental health records under the GCA are typically generated by 
the courts that adjudicate persons as mentally defective, and by the courts and health care 
providers that involuntarily commit individuals to mental health facilities. While courts are not 
covered entities and are not subject to the HIPAA privacy rule, health care providers such as 
hospitals and state health departments are covered by the privacy rule and, therefore, may not use 
or disclose PHI for the purpose of NICS reporting without express permission under the rule. As 
described below, it is necessary to look to the states to determine whether such permission exists. 

Interaction of HIPAA Privacy Rule and State Privacy Laws 

Although the HIPAA privacy rule provides a federal floor with respect to the uses and disclosures 
of PHI, the overall scope of the privacy rule may be modulated by state law. If a state requires 
covered entities to disclose prohibiting mental health records to NICS, the HIPAA privacy rule 
does not prohibit that disclosure . 52 Therefore, the privacy rule is most relevant as a potential 
obstacle where prohibiting mental health records are held by covered entities in a state that does 
not require disclosure of such records to NICS. This would be the case even if the state expressly 
allowed, but did not explicitly require, disclosure of prohibiting mental health records to NICS 
because merely permissive state laws are insufficient to exempt disclosure from the HIPAA 
privacy rule. 

It should also be noted that both types of entities — courts and health care providers — may also be 
subject to state health privacy laws that may be more protective of individually identifiable health 
information than the HIPAA privacy rule and other state-level requirements and policies. State 



48 45 C.F.R. §164. 512(a) 

49 45 C.F.R. §164.512(1) 



50 4 5 C.F.R. §164.512(j). On January 15, 2013, the HHS Office for Civil Rights issued a letter to health care providers 
in which he reminded them of the privacy rule’s “duty to warn” provision, which permits the disclosure of patient 
infonnation to avert threats to health or safety. See http://www.hhs.gov/ocr/office/lettertonationhcp.pdf. 

51 45 C.F.R. § 164.5 12(k) 
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laws that are more protective of privacy include those that prohibit or restrict a use or disclosure 
that would otherwise be permitted under the privacy rule, and those that provide individuals with 
greater access to their own health information. This final section of the report provides a basic 
overview of the different types of state privacy laws that may impact the sharing of prohibiting 
mental health records with NICS. 

Figure 1 summarizes state laws that address the reporting of mental health records for use in 
firearm purchaser background checks. Twenty-three states have NICS reporting mandates. 53 
These laws require courts and, in some instances, mental health facilities to report (1) to NICS 
directly, or (2) to a state agency that in turn reports to NICS. As noted above, the HIPAA privacy 
rule would not bar the mandated disclosures in these states. Note that in one of the states — 
Delaware — reporting by mental health facilities takes the place of court reporting (see Figure 1). 

Seven states have laws that authorize, but do not require, reporting to NICS. 54 In these states that 
do not mandate reporting, HIPAA-covered entities do not appear to have permission under the 
privacy rule to use or disclose PHI for the purpose of preparing and reporting mental health 
records to NICS. Absent a state reporting mandate, it is not clear that there are any other 
provisions in the privacy rule that provide such permission. 

None of the three other national priority purposes in the privacy rule discussed earlier (under 
“HIPAA Privacy Rule Overview”) address reporting to federal databases for the purposes of 
future background checks. The disclosure of PHI for law enforcement purposes has to be (1) as 
required by law; (2) pursuant to various specified judicial and administrative processes and 
procedures such as court orders, subpoenas, and summonses; or (3) in response to one of several 
other specified law enforcement activities. 55 The privacy rule’s provisions authorizing the use or 
disclosure of PHI for various specialized government functions list a number of specific 
activities, none of which includes reporting information to the NICS databases. 56 Finally, the 
rule’s provisions that permit the use and disclosure of PHI to avert a serious threat to health or 
safety focus on two types of situations, neither of which appears to include NICS reporting. The 
first permits the disclosure of PHI to a person or persons reasonably able to prevent or lessen a 
serious and imminent threat to the health or safety of a person or the public. The second concerns 
alerting law enforcement authorities about an individual involved in a violent crime or who has 
escaped from prison or lawful custody. 57 

An additional eight states collect mental health records pursuant to state law, but these laws do 
not address NICS reporting/ s Again, without a NICS reporting mandate, HIPAA-covered entities 
do not appear to have permission under the privacy rule to use PHI for the purpose of reporting 



53 AL. CO, CT, DE, GA, ID, IL, IN, IA, KS, KY, ME, MN, NV, NC, ND, NY, OR, TN, TX, WA, WI, and VA; see 

Figure 1. 

54 AZ, FL, MO, NE, NJ, PA, and WV; see Figure 1. In some cases, whether state law requires disclosure to NICS may 

be ambiguous. For example, New Jersey state law currently prohibits disclosure of commitment records disclosure 
except as needed to comply with the data reporting provisions of the NIAA or the Brady Act, but it is not clear that 
either of those laws impose any such requirements. The state is currently considering Assembly Bill No. 3717, which 
would amend state law to explicitly require reporting of institutionalized persons to NICS. http://www.njleg.state.nj.us/ 
20 1 2/Bills/ A4000/37 1 7_1 1 .HTM * 

55 45 C.F.R. § 1 64.5 12(k) 

56 45 C.F.R. § 1 64.5 12(k) 

57 45 C.F.R. §164.5120) 

58 AR, CA, HI, MA, MD, MI, OH and UT; see Figure 1. 
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mental health records to the federal databases. These states include California, which despite the 
absence of a NICS reporting mandate, has one of the best NICS reporting rates for mental health 
records. In part this is because of a state law that requires mental health facilities to report mental 
health records to the California Department of Justice (DOJ). That requirement effectively 
removes HIPAA as an impediment to such reporting by HIPAA-covered entities. While state law 
is silent on DOJ reporting to NICS, California has developed a reporting infrastructure and 
entered into an agreement with the federal government to report mental health records to NICS. 

Finally, 13 states are without laws requiring or authorizing the collection or reporting of mental 
health records for use in firearm purchaser background checks, either at the state or federal level. 
Once again, HIPAA-covered entities in these states that are in possession of disqualifying mental 
health records appear to lack the authority under the privacy rule to report such information to 
NICS. 

On February 14, 2013, in response to the President’s instruction to address any potential legal 
barriers to NICS reporting, HHS announced that it will seek to amend the HIPAA privacy rule to 
remove any potential impediments to state reporting of mental health records to NICS. 59 The 
HHS Office for Civil Rights (OCR), which administers and enforces the privacy rule, plans to 
issue an advance notice of proposed rulemaking (ANPRM) to solicit public comment on this 
issue prior to proposing any changes to the privacy rule. 60 

While a detailed examination of state-level activities is beyond the scope of this report, it should 
be emphasized that many states collect and use mental health records (and other relevant 
information) pursuant to state law or policies for their own background checks of firearm 
purchases. Some states are “Point-Of-Contact” (POC) states, meaning that the state agency is 
responsible for electronically accessing NICS and for implementing and maintaining their own 
Brady NICS program. 61 Often times a POC state will run the background check against the state’s 
own records, some of which may not be in NICS. In some instances, background checks 
conducted by POCs may be more stringent than non-POC states because they have access to 
more access to disqualifying records. In addition, these states could be more thorough in their 
background checks because statutory prohibitions on firearm possession in these states sometimes 
exceed the federal prohibitions under the Brady Act. However, unlike the nationwide NICS 
background checks, state-level checks do not capture prohibited individuals who cross state lines 
to purchase long guns. 



59 HIPAA provides the HHS Secretary with authority to modify the privacy standards, as detennined appropriate, but 
not more frequently than once every 12 months. Any addition or modification to a standard must “be completed in a 
manner that minimizes the disruption and cost of compliance.” 42 U.S.C. § 1 320d— 3(b)( 1 ). 

60 Kendra Casey Plank, “HIPAA Privacy Rule Changes Could Ease Sharing of Mental Health Records by States,” 
Bloomberg BNA, Health Care Daily Report, February 15, 2013. 

61 See Federal Bureau of Investigation, National Instant Criminal Background Check System- Participation Map, 
available at, http://www.fbi.gov/about-us/cjis/nics/general-information/participation-map. 
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Figure I. State Laws That Require or Authorize the Reporting of Mental Health Records to NICS 



As of January 1 , 20 1 3 




States that lack explicit laws requiring or 
authorizing mental health record collection. 
States that collect mental health records 
but do not address NICS reporting. 

States that authorize but do not require 
reporting to NICS. 



I States that require courts or mental health facilities 
(DE only) to report directly to NICS. 

| States that require courts to report to a state 
agency that must report to NICS. 

J States that require courts and mental health facilities 
to report to a state agency that must report to NICS. 



Source: Prepared by CRS based on a review and analysis of laws in all 50 states and the District of Columbia that address the reporting of mental health records for use in 
firearm purchaser background checks. 



Note: CRS’s characterization of state laws is in broad agreement with a similar analysis by the Law Center to Prevent Gun Violence — a nonprofit organization that 
advocates for gun-control legislation and provides legal expertise and information on U.S. gun laws — but with one key difference. Whereas the Law Center characterized 
Virginia as a state that authorizes but does not require reporting to NICS, CRS concluded that Virginia’s law requires NICS reporting. The Law Center’s analysis is available 
at http://smartgunlaws.org/mental-health-reporting-policy-summary/. 
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